oauth(docs): replace hardcoded state secrets with process env variables

[zimeg]

Summary

This PR replaces examples of hardcoded state secrets with an environment variable to match slackapi/bolt-js#2220

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 92.51%. Comparing base (02f9b87) to head (7743f21).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2039   +/-   ##
=======================================
  Coverage   92.51%   92.51%           
=======================================
  Files          37       37           
  Lines        9981     9981           
  Branches      633      631    -2     
=======================================
  Hits         9234     9234           
  Misses        747      747           

Flag	Coverage Δ
cli-hooks	95.23% <ø> (ø)
cli-test	96.00% <ø> (ø)
oauth	81.52% <ø> (ø)
socket-mode	59.08% <ø> (ø)
web-api	97.29% <ø> (ø)
webhook	97.07% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[filmaj]

LGTM but can you also add the env var to the list of env vars needed in the relevant samples' README.md?

[zimeg]

@filmaj A good call as always, thanks for catching that and the fast review 🙏